Abstract:

Traditional flow-based attack detection cannot fully capture network communication patterns, and it is difficult to effectively detect attack events that exist in the network. The information contained in the flow behavior graph can effectively reflect the real behavior of the host. Aiming at the detection of multiple types of network attacks, this article proposed an attack detection method based on flow behavior graph, and the attack detection based on flow behavior graph was realized. The detection method is based on clustering and a generative learning model, and consists of two stages. The first stage uses a clustering algorithm to filter benign nodes as much as possible, and the second stage uses a generative learning model to detect a variety of different attack events. The experimental results on the public data set show that the attack detection method proposed in this article can effectively detect a variety of different attack events in the network. In addition, the system uses a distributed processing framework based on Apache Spark, which can effectively process large-scale data.

Key words: flow behavior graph, clustering, generative learning, attack detection, Spark